FIG. 1 depicts conventional networks 10 and 20 which may be connected to the Internet 30. Each network 10 and 20 includes host 12, 14 and 16 and 22 and 24, respectively. Each network 10 and 20 also includes a switch 18 and 26, respectively, and may include one or more servers such as the servers 17, 19 and 28, respectively. In addition, each network 10 and 20 may include one or more gateways 13 and 25, respectively, to the Internet 30. Not explicitly shown are routers and other portions of the networks 10 and 20 which may also control traffic through the networks 10 and 20 and which will be considered to be inherently depicted by the switches 18 and 26, respectively, and the networks 10 and 20 in general.
FIG. 2 depicts a portion of a typical switch 50, which may be used for the switches 18 and 26 (FIG. 1) and/or a router (not shown). The switch 50 includes a network processor 52 and storage 54. The switch 50 typically also includes other components (not shown). The network processor 52 manages functions of the switch 50, including the classification of packets using the rules described below. The storage 54 retains data relating to the rules.
Referring to FIGS. 1 and 2, in order to manage communications in a network, such as the network 10 or 20, filter rules are used. Filter rules are typically employed by switches, routers and other portions of the network to perform packet classification. Each filter rule is used to classify packets which are being transmitted via a network in order to determine how the packet should be treated and what services should be performed. For example, a filter rule may be used in testing packets entering the network from an outside source to ensure that attempts to break into the network can be thwarted. For example, traffic from the Internet 30 entering the network 10 may be tested in order to ensure that packets from unauthorized sources are denied entrance.
Similarly, packets from one portion of a network may be prevented from accessing another portion of the network. For example, a packet from some of the hosts 12, 14 or 16 may be prevented access to either the server 17 or the server 19. The fact that the host attempted to contact the server may also be recorded so that appropriate action can be taken by the owner of the network.
Such filter rules may also be used to transmit traffic based on the priorities of packets. For example, packets from a particular host, such as the host 12, may be transmitted because the packets have higher priority even when packets from the hosts 14 or 16 may be dropped. The filter rules may also be used to ensure that new sessions are not permitted to be started when congestion is high even though traffic from established sessions is transmitted. Other functions could be achieved based on the filter rule as is well known to those skilled in the art.
In order to determine whether a particular rule will operate on a particular packet, a key is tested. The key typically includes selected fields, known collectively as the TCP/IP 5-tuple or just the 5-tuple, extracted from the Internet Protocol (IP) and TCP headers of the packet. The IP and TCP headers typically contain five fields of interest: the source address (SA), the destination address (DA), the source port (SP), the destination port (DP) and the protocol. These fields are typically thirty-two bits, thirty-two bits, sixteen bits, sixteen bits and eight bits, respectively. Rules typically operate on one or more of these fields. For example, based on the source and/or destination addresses, the rule may determine whether a packet from a particular host is allowed to reach a particular destination address.
In addition to the fields of the TCP/IP 5-tuple, the key can also include additional fields that are related to service-level agreements, e.g., Quality of Service (QoS). In particular, the key can include fields for an ingress context and an egress context. A context may refer to a port number, a VLAN number, VPN number, ATM Virtual Circuit Number, or some combination of these and other possible session identification parameters. Thus, filter rules relating to an ingress or egress context also include additional bits (fields) corresponding to the ingress and egress contexts.
In testing a key against a filter rule, it is determined whether the filter rule should be enforced against the packet associated with the key. The key is tested by comparing specified fields for the key of the packet with a range(s) of values defined by the filter rule. Each rule contains a range of values in one or more dimensions. Each dimension corresponds to a field of the key (typically the IP header). One type of filter rule has a range consisting of a single value or a spread of values. In such a case, a “Range-rule” search is performed to determine whether the key exactly matches the value for the rule. Other rules have ranges which can be expressed using a single prefix. The prefix is a binary number containing a number of ones and zeroes (1 or 0), followed by place holders, or wildcards (*). In this case, a “Wildcard-match” is performed to determine whether the rule applies to the packet.
Testing the key against a filter rule can be a tedious and time consuming procedure, which is multiplied several times over when the number of filter rules increases. In order to expedite this process, a search facility known as a “Software-managed tree” (SMT) search engine is utilized. Generally, the SMT search engine analyzes a collection of filter rules, and based on the rules' conditions, builds a plurality of binary tree structures. Each tree structure is a binary tree that includes a series of hierarchical single bit test nodes and leaf nodes. At each single bit test node, a specified bit of the key is tested, and depending on the value of the test bit, a path is followed, which terminates at a leaf. Each leaf includes a filter rule that includes the rule specification and defines an action to be taken with regard to a packet. The SMT search engine is described in more detail in U.S. Pat. No. 6,298,340, entitled, “SYSTEM AND METHOD AND COMPUTER PROGRAM FROM FILTERING USING TREE STRUCTURE” issued on Oct. 2, 2001, and assigned to the assignee of the present invention.
The SMT search engine enables a search on multiple fields within the key, and within each field, looks for either a pattern under a mask (Wildcard match), or a range specified by a minimum or a maximum (Range-rule), as the criteria for declaring a match. The search engine can utilize standard memory structures resulting in an economical implementation. Nevertheless, utilizing such memory structures presents issues. For example, characteristics of the tree structures contribute to excessive latency in completing the searches and contribute to an inefficient use of storage space. Thus, utilizing standard memory structures, while economical, makes it very difficult to support multi-field classification in an SMT engine.
Current solutions to this issue include utilizing a ternary content addressable memory (TCAM). TCAMs include logic, such as a comparator, for each location. The logic allows the entries of the TCAM to be searched in parallel. Nevertheless, although TCAMs provide high-performance multi-field classification, they also add significant costs to a system.
Accordingly, what is needed is a system for providing high-performance multi-field classification utilizing standard memory structures. The system should implement an improved search facility that maintains the cost advantage of using standard memory structures, while improving performance to approach that of a more expensive TCAM solution. The present invention addresses such a need.